{{ summaryTitle }}
{{ summaryValue }}

{{ summaryLine }}

{{ badge.label }}{{ badge.value }}
Choose the mail-key record family to request.
Use a mailbox normally; exact owner is for zone-file and resolver diagnostics.
One mailbox only. The selected public resolver receives the derived owner name, not the raw local part.
The family label must agree with the selected record family.
A public recursive answer is a time-specific snapshot, not authoritative-zone proof.
Off is neutral. Enable during publication, rollover, or inconsistent lookup results.
{{ compareResolversEnabled ? 'Both resolvers' : 'Selected policy only' }}
Accepted range: 1000–15000 ms. Default: 4500 ms.
ms
Decision brief
{{ computation.values.outcome_label }}. {{ computation.values.recommendation }}
Lookup owner
{{ computation.values.owner_name }}
Record family
{{ computation.values.family_label }} (type {{ computation.values.rr_type }})
Primary resolver
{{ computation.values.primary_resolver }}
Resolver agreement
{{ computation.values.agreement }}
Trust boundary
A positive answer still requires DNSSEC validation and certificate or OpenPGP key verification.
Primary resolver trust profile
StageSignalValueMeaningCopy
{{ row.stage }}{{ row.signal }}{{ row.value }}{{ row.meaning }}
DNS Record Lookup Look up DNS records for a domain, URL or IP through Google or Cloudflare with response codes, returned TTL evidence and DNSSEC flags.
MX Record Lookup Inspect a domain's MX route and compare public DNS answers while catching Null MX conflicts, unresolved exchanges, and alias targets.
DKIM DNS Record Generator Build a DKIM TXT record from a selector and public key with validation and DNS string splitting, plus rollout checks before publishing.
DMARC DNS Record Generator Build a current or legacy DMARC TXT record with policy inheritance and reporting destinations plus DNS string splitting and rollout review.

Email key discovery can publish cryptographic material in the Domain Name System (DNS) without exposing the mailbox local part as a readable label. SMIMEA records associate an S/MIME certificate with a mailbox. OPENPGPKEY records publish an OpenPGP transferable public key. Both use a prepared, hashed mailbox name beneath the recipient's domain.

SMIMEA
DNS record type 53, carrying certificate-association data for S/MIME.
OPENPGPKEY
DNS record type 61, carrying an OpenPGP transferable public key.
Owner name
The hashed local-part label, the family label, and the mailbox domain joined as a DNS name.

Publication and trust are different decisions. Finding a record shows what one recursive resolver returned at that time. Trust-sensitive use also depends on correct owner derivation, DNS Security Extensions (DNSSEC), a trusted resolver path, and verification of the returned certificate or key through the intended mail-security workflow.

Mailbox spelling matters. Case variants, plus-address aliases, dot folding, and provider-specific aliases may deliver to the same inbox while producing different owner names. The published record must match the identity form chosen by the domain operator; a lookup cannot guess that policy.

DNS caches add another boundary. A missing record may reflect a wrong owner, a genuine absence, an unexpired negative cache, or publication that has not reached the selected resolver. During a rollover, two resolvers can temporarily return different record sets without either snapshot proving the current authoritative state by itself.

How to Use This Tool:

Choose the record family first because it changes both the DNS type and the owner-name label.

  1. Select SMIMEA or OPENPGPKEY.
  2. Keep Mailbox for normal use and enter one email identity. Choose Exact owner only when testing a known zone-file name or resolver path.
  3. Choose the resolver policy. Auto prefers Cloudflare and can fall back to Google Public DNS; enable Compare public resolvers during publication, rollover, or inconsistent results.
  4. Run the lookup and read the outcome, DNSSEC badge, resolver agreement, owner derivation, cache evidence, and returned payload summary.
  5. If the result is missing or inconsistent, verify the family label and exact mailbox form, account for the shown cache time, and compare authoritative DNS before changing key material.

Interpreting Results:

  • Record found confirms that the selected recursive resolver returned the requested type. It does not independently authenticate the certificate or OpenPGP key.
  • AD set reports that the resolver marked the answer as authenticated. Rely on that claim only through a resolver and transport path you trust.
  • Owner exists without this record differs from Owner name does not exist. The first is a no-data response for the requested type; the second is NXDOMAIN.
  • Resolver drift detected means the compared outcome or record-set digest differs. Check authoritative data, signing state, aliases, and time-to-live values.
  • A transport error is not a DNS answer. Retry or adjust the 1,000-to-15,000 ms timeout before drawing a publication conclusion.

Technical Details:

RFC 7929 and RFC 8162 use the same basic owner-name construction with different family labels. The mailbox local part is prepared as UTF-8 text, hashed with SHA-256, and truncated to its leftmost 28 octets. Hexadecimal encoding turns those 28 octets into a 56-character DNS label.

Transformation Core

The complete derivation is short enough to audit as a fixed path:

  1. Separate the mailbox at its final @ into local part and domain.
  2. Remove enclosing quotes and quoted escapes where applicable; for an unquoted local part, remove comments and whitespace around dots. Normalize non-ASCII text to Unicode NFC.
  3. Encode the prepared local part as UTF-8 and calculate its SHA-256 digest.
  4. Keep the first 56 hexadecimal characters, representing the leftmost 28 digest octets.
  5. Append ._smimecert. for SMIMEA or ._openpgpkey. for OPENPGPKEY, followed by the ASCII DNS domain.
FamilyOwner patternDNS typePayload meaning
SMIMEA56-hex._smimecert.domain53Certificate usage, selector, matching type, and association data
OPENPGPKEY56-hex._openpgpkey.domain61Transferable public-key material

For hugh@example.com, the published RFC examples begin with the label c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6. Selecting SMIMEA therefore queries that label beneath _smimecert.example.com; OPENPGPKEY uses the same hash beneath its own family label.

Lookup and decision Rule Core

One or two public recursive-resolver observations are normalized into the same outcome vocabulary. A returned type-53 or type-61 record takes precedence as Record found. Otherwise a transport failure, NXDOMAIN response, alias without a terminal record, NOERROR response with no requested data, or another resolver error determines the outcome.

The preferred resolver supplies the primary snapshot when it returns the requested record. If it does not, another positive observation may become primary. Two resolver observations agree only when both their outcome and returned-set digest agree. Up to four CNAME hops and up to 20 requested records are retained for review.

Positive time-to-live (TTL) values describe cache life for returned data. For negative answers, the lower usable value from the authority SOA record's TTL and minimum field is reported when present. These values explain when a repeated lookup may change; they do not schedule authoritative publication.

DNSSEC boundary

The Authenticated Data (AD) bit is a claim made by the recursive resolver that the relevant answer and authority data authenticated under its policy. It is valuable evidence when the resolver is trusted over a secure channel, but it is not local signature validation and does not prove that the cryptographic payload belongs to the intended human recipient.

Security and Privacy Notes:

The local part is prepared and hashed in the browser. The chosen public resolver receives the derived owner name and requested record type, or the exact owner name when that mode is used. The hash reduces casual exposure in DNS but is stable and may be guessable for known mailbox candidates.

  • No external DNS request runs until you start the lookup.
  • A positive record is discovery evidence, not proof of identity, key ownership, validity, revocation state, or suitability.
  • Do not paste private keys, certificate private material, or unrelated confidential data into the mailbox or exact-owner fields.

References: